Actions
List actions
The actions you registered, newest first. It does not include Lelemon tools or MCP tools: see GET /v2/agents/{id}/tools for what an agent can use.
Required scope: actions:read.
query Parameters
limitcursorThe nextCursor of the previous page, with the same filters.
Headers
Lelemon-Subaccount^sub_[0-9A-Za-z]{22}…The subaccount (sub_…) this request acts on. Only for the keys of a platform account; without it the request acts on the account itself.
List actions › Responses
objecthasMorenextCursorCreate an action
Registers an HTTP endpoint of yours that agents can call. The URL must be public and its site must be allowed for this key (an administrator adds sites to the key). Credentials go in request.headers: they are stored encrypted and never returned. Nothing can use the action until you grant it to an agent with PUT /v2/agents/{id}/tools/{toolId}. The URL is called exactly as written: a placeholder such as {id} is rejected with 400 (param request.url); what the agent must fill goes in input (query for GET, body otherwise). Optional authorization block records the purpose and where the system is hosted (Law 21.719): read the text with GET /v2/actions/authorization. Use dryRun=true to run the same checks (name, site allowed for the key, destination, input, authorization) and get 200 with the action as it would be saved, without saving it; its id is not saved.
Required scope: actions:write.
query Parameters
dryRunWhen true, the request goes through the same validation as the real one and is answered with what would happen (always 200), and nothing is saved, sent or charged. The answer has the same shape as the real one plus dryRun: true; an id in it is not saved. It does not use the Idempotency-Key.
Headers
Lelemon-Subaccount^sub_[0-9A-Za-z]{22}…The subaccount (sub_…) this request acts on. Only for the keys of a platform account; without it the request acts on the account itself.
Idempotency-KeyMakes the request safe to retry. Once it starts running, its final response (2xx, 4xx or 5xx) is kept for 24 hours and the same key gets it back, without repeating the effect. A request rejected before it runs leaves the key free. A replayed create omits the secret. The same key with a different request is rejected with 409 idempotency_key_reused.
Create an action › Request Body
name^[a-z][a-z0-9_]{0,63… · requiredWhat the agent calls it: lowercase letters, digits and underscores, starting with a letter. It cannot change later.
descriptionWhen to use it. The agent reads this to decide.
JSON Schema of what the agent must send: type "object" with properties. The agent fills it in; for GET it goes in the query, otherwise in the body.
audienceWhich agents may be granted it: all, or customers (only agents that talk to the public).
noPersistWhen true, what this action returns lives only in the turn that called it. It is not kept in the tool memory between turns, in the execution trace, in approval requests or in run steps. The agent still uses it to answer. Consequences: the action cannot be replayed from a stored result, and a run interrupted in the middle of a round that called it fails instead of resuming. The provider (Bedrock) still receives the content as part of the prompt of that turn.
sharedWithSubaccountsPlatforms only. When true, every subaccount of yours can grant this action to its own agents. The action keeps living in your organization: calls to it are signed with your signing secret and carry the Lelemon-Subaccount-Id of the subaccount that made the call. Subaccounts cannot read, change or delete it. Turning it off, or deleting the action, removes it from the agents of your subaccounts. Its name cannot match an action that one of your subaccounts already has.
Fields Lelemon fills when it makes the call, not the agent: the agent does not see them and cannot invent them. They go in the query for GET and in the body otherwise. If Lelemon does not have the value, the field is left out.
The authorization to send personal data to your system (article 15 bis of Law 21.719): purpose, where it is hosted and the accepted text version. Optional as a block, but if you send it, send all of it. Without it the action is saved anyway, and it can be added later with PATCH.
Create an action › Responses
dryRun=true: the action as it would be saved.
objectidnamedescriptionaudiencenoPersistWhen true, what this action returns lives only in the turn that called it. It is not kept in the tool memory between turns, in the execution trace, in approval requests or in run steps. The agent still uses it to answer. Consequences: the action cannot be replayed from a stored result, and a run interrupted in the middle of a round that called it fails instead of resuming. The provider (Bedrock) still receives the content as part of the prompt of that turn.
sharedWithSubaccountsPlatforms only. When true, every subaccount of yours can grant this action to its own agents. The action keeps living in your organization: calls to it are signed with your signing secret and carry the Lelemon-Subaccount-Id of the subaccount that made the call. Subaccounts cannot read, change or delete it. Turning it off, or deleting the action, removes it from the agents of your subaccounts. Its name cannot match an action that one of your subaccounts already has.
The fields Lelemon fills on every call. Empty when there are none.
The authorization in force for the destination of this action: what you accepted when you created it or last changed its destination. null when there is none, for example after the destination changed and was not authorized again, and always null on an action shared by your platform.
createdAtupdatedAtdryRunPresent and true when the request had dryRun=true.
Read the current authorization text
The text you accept when an action sends personal data to your system (article 15 bis of Law 21.719), its version and the extra confirmation for a system outside Chile. Read it before sending authorization in POST /v2/actions or PATCH /v2/actions/{id}; when the text changes, the version changes and old versions are refused. Read only.
Required scope: actions:read.
Headers
Lelemon-Subaccount^sub_[0-9A-Za-z]{22}…The subaccount (sub_…) this request acts on. Only for the keys of a platform account; without it the request acts on the account itself.
Read the current authorization text › Responses
objectversionThe version to send as authorization.version.
textThe authorization to deliver data to your system (article 15 bis of Law 21.719), which you accept every time.
detailWhat the text means in practice.
The extra confirmation for a system outside Chile. Accept it with authorization.confirmsTransferOutsideChile.
countriesRotate the signing secret of your actions
Every call of an action to your system carries a Lelemon-Signature header and the turn context (case, contact, subaccount, actor). The secret behind it belongs to your organization and each action gets its own, derived from it. This creates a new one: the previous keeps signing alongside the new one for 24 hours, so you can change the secrets in your systems without a cut. Every call rotates again, and the secret of the earlier rotation stops being listed: send an Idempotency-Key so a retry does not rotate twice. The response does not carry any secret: read each one with GET /v2/actions/{id}/signing-secret. Use dryRun=true to see when the previous secret would stop working; nothing rotates.
Required scope: actions:write.
query Parameters
dryRunWhen true, the request goes through the same validation as the real one and is answered with what would happen (always 200), and nothing is saved, sent or charged. The answer has the same shape as the real one plus dryRun: true; an id in it is not saved. It does not use the Idempotency-Key.
Headers
Lelemon-Subaccount^sub_[0-9A-Za-z]{22}…The subaccount (sub_…) this request acts on. Only for the keys of a platform account; without it the request acts on the account itself.
Idempotency-KeyMakes the request safe to retry. Once it starts running, its final response (2xx, 4xx or 5xx) is kept for 24 hours and the same key gets it back, without repeating the effect. A request rejected before it runs leaves the key free. A replayed create omits the secret. The same key with a different request is rejected with 409 idempotency_key_reused.
Rotate the signing secret of your actions › Responses
objectrotatedAtpreviousValidUntilUntil when calls signed with the previous secret still verify. Read the new secret of each action with GET /v2/actions/{id}/signing-secret.
dryRunPresent and true when the request had dryRun=true.
Retrieve the signing secret of an action
Use it to verify that a call to your system comes from Lelemon: pass the whole secrets list, the raw body and the full URL to verifyRequest of the SDK. It needs actions:write because it is a secret. Read only; calling it again returns the same secrets until you rotate. The Test an action endpoint does not sign: only calls made in a turn do.
Required scope: actions:write.
path Parameters
id^act_[0-9A-Za-z]{22}… · requiredThe id of the action (act_…).
Headers
Lelemon-Subaccount^sub_[0-9A-Za-z]{22}…The subaccount (sub_…) this request acts on. Only for the keys of a platform account; without it the request acts on the account itself.
Retrieve the signing secret of an action › Responses
objectactionIdsecretsThe secrets that sign the calls of this action, newest first. After a rotation the previous one is still listed for 24 hours: pass the whole list to verifyRequest. Each action has its own secret, derived from the one of your organization, so share it only with the system that serves that action.
previousValidUntilWhen the previous secret stops being listed. Absent when there is no previous secret.
Retrieve an action
Returns one action by id. Use it to refresh a single record you already know; to find records, use the list route. Read only. 404 not_found when the id does not exist or belongs to another organization. You can repeat it safely: it has no side effects.
Required scope: actions:read.
path Parameters
id^act_[0-9A-Za-z]{22}… · requiredThe id of the action (act_…).
Headers
Lelemon-Subaccount^sub_[0-9A-Za-z]{22}…The subaccount (sub_…) this request acts on. Only for the keys of a platform account; without it the request acts on the account itself.
Retrieve an action › Responses
objectidnamedescriptionaudiencenoPersistWhen true, what this action returns lives only in the turn that called it. It is not kept in the tool memory between turns, in the execution trace, in approval requests or in run steps. The agent still uses it to answer. Consequences: the action cannot be replayed from a stored result, and a run interrupted in the middle of a round that called it fails instead of resuming. The provider (Bedrock) still receives the content as part of the prompt of that turn.
sharedWithSubaccountsPlatforms only. When true, every subaccount of yours can grant this action to its own agents. The action keeps living in your organization: calls to it are signed with your signing secret and carry the Lelemon-Subaccount-Id of the subaccount that made the call. Subaccounts cannot read, change or delete it. Turning it off, or deleting the action, removes it from the agents of your subaccounts. Its name cannot match an action that one of your subaccounts already has.
The fields Lelemon fills on every call. Empty when there are none.
The authorization in force for the destination of this action: what you accepted when you created it or last changed its destination. null when there is none, for example after the destination changed and was not authorized again, and always null on an action shared by your platform.
createdAtupdatedAtDelete an action
Also removes it from every agent that had it. The name stays reserved: creating an action with the same name again brings this one back with what you send.
Required scope: actions:write.
path Parameters
id^act_[0-9A-Za-z]{22}… · requiredThe id of the action (act_…).
Headers
Lelemon-Subaccount^sub_[0-9A-Za-z]{22}…The subaccount (sub_…) this request acts on. Only for the keys of a platform account; without it the request acts on the account itself.
Delete an action › Responses
Deleted.
Update an action
Changes only what you send. request is merged field by field; input replaces the whole schema. The name cannot change. Use dryRun=true to run the same checks and get the action as it would be saved, without saving it.
Required scope: actions:write.
path Parameters
id^act_[0-9A-Za-z]{22}… · requiredThe id of the action (act_…).
query Parameters
dryRunWhen true, the request goes through the same validation as the real one and is answered with what would happen (always 200), and nothing is saved, sent or charged. The answer has the same shape as the real one plus dryRun: true; an id in it is not saved. It does not use the Idempotency-Key.
Headers
Lelemon-Subaccount^sub_[0-9A-Za-z]{22}…The subaccount (sub_…) this request acts on. Only for the keys of a platform account; without it the request acts on the account itself.
Update an action › Request Body optional
descriptionMerged into the current request, field by field.
Replaces the whole input schema.
noPersistWhen true, what this action returns lives only in the turn that called it. It is not kept in the tool memory between turns, in the execution trace, in approval requests or in run steps. The agent still uses it to answer. Consequences: the action cannot be replayed from a stored result, and a run interrupted in the middle of a round that called it fails instead of resuming. The provider (Bedrock) still receives the content as part of the prompt of that turn.
sharedWithSubaccountsPlatforms only. When true, every subaccount of yours can grant this action to its own agents. The action keeps living in your organization: calls to it are signed with your signing secret and carry the Lelemon-Subaccount-Id of the subaccount that made the call. Subaccounts cannot read, change or delete it. Turning it off, or deleting the action, removes it from the agents of your subaccounts. Its name cannot match an action that one of your subaccounts already has.
Replaces the whole list; omit it to keep the current one and send [] to remove them. Fields Lelemon fills when it makes the call, not the agent: the agent does not see them and cannot invent them. They go in the query for GET and in the body otherwise. If Lelemon does not have the value, the field is left out.
Registers or renews the authorization to send data to your system. Needed again when you change the destination site or where it is hosted.
Update an action › Responses
objectidnamedescriptionaudiencenoPersistWhen true, what this action returns lives only in the turn that called it. It is not kept in the tool memory between turns, in the execution trace, in approval requests or in run steps. The agent still uses it to answer. Consequences: the action cannot be replayed from a stored result, and a run interrupted in the middle of a round that called it fails instead of resuming. The provider (Bedrock) still receives the content as part of the prompt of that turn.
sharedWithSubaccountsPlatforms only. When true, every subaccount of yours can grant this action to its own agents. The action keeps living in your organization: calls to it are signed with your signing secret and carry the Lelemon-Subaccount-Id of the subaccount that made the call. Subaccounts cannot read, change or delete it. Turning it off, or deleting the action, removes it from the agents of your subaccounts. Its name cannot match an action that one of your subaccounts already has.
The fields Lelemon fills on every call. Empty when there are none.
The authorization in force for the destination of this action: what you accepted when you created it or last changed its destination. null when there is none, for example after the destination changed and was not authorized again, and always null on an action shared by your platform.
createdAtupdatedAtdryRunPresent and true when the request had dryRun=true.
Test an action
Calls your endpoint once with the sample input, the way an agent would, but without an agent. The answer is the status and the body your endpoint returned, cut at 4000 characters and with your credential hidden. A refused destination is a 400; an endpoint that does not answer is a 200 with ok false. At most 10 tests per minute per organization. Note that it really calls your endpoint: use sample data when the action writes.
Required scope: actions:write.
path Parameters
id^act_[0-9A-Za-z]{22}… · requiredThe id of the action (act_…).
Headers
Lelemon-Subaccount^sub_[0-9A-Za-z]{22}…The subaccount (sub_…) this request acts on. Only for the keys of a platform account; without it the request acts on the account itself.
Idempotency-KeyMakes the request safe to retry. Once it starts running, its final response (2xx, 4xx or 5xx) is kept for 24 hours and the same key gets it back, without repeating the effect. A request rejected before it runs leaves the key free. A replayed create omits the secret. The same key with a different request is rejected with 409 idempotency_key_reused.
Test an action › Request Body optional
Sample input, as the agent would send it. For GET it goes in the query, otherwise in the body.
Test an action › Responses
objectokTrue when your endpoint answered with a 2xx status.
durationMsbodyWhat your endpoint answered, cut at 4000 characters, with your credential hidden.
truncatedstatusAbsent when your endpoint did not answer.
failureRead the approval floor of a shared action
The minimum approval your platform set for a shared action, or mode never when there is none. Subaccounts that use the action cannot go below it. Read only and safe to repeat.
Required scope: actions:read.
path Parameters
id^act_[0-9A-Za-z]{22}… · requiredThe id of the action (act_…).
Headers
Lelemon-Subaccount^sub_[0-9A-Za-z]{22}…The subaccount (sub_…) this request acts on. Only for the keys of a platform account; without it the request acts on the account itself.
Read the approval floor of a shared action › Responses
modenever: the agent runs the action without approval. always: every call waits for a person. when: only the calls that meet condition, or that pass accumulated, wait. rules: the ordered list in rules decides each call; the first rule that applies wins.
Only for mode when. A comparison {param, op, value} with op eq, ne, gt, gte, lt, lte, in (value is a list) or exists (no value), or a group {all: [...]} or {any: [...]}. Up to 3 levels and 10 comparisons. If the argument is missing or has another type the call needs approval. param is a path into the arguments of the action, like amount or order.total.
Only for mode rules. Evaluated in order for every call: the first rule whose when applies decides, and the rest are not read. A rule without when applies to every call and has to be last. If no rule applies the call runs, so end with a rule that has no when to choose the default. Use it for a hard cap ("above X, reject"), or for steps by amount ("up to X a supervisor decides, above X the management"). A platform floor and accumulated still apply on top: a rule can never run an action the floor sends to a person.
Who may decide. Without it: owners and admins. A role includes the roles above it: admin also lets owners decide. An API key decides only if it is named here.
expiresInMinutesMinutes to decide. Past it the request expires, the action never runs and the agent tells the person.
escalateAfterMinutesMinutes after which a pending request escalates: approval.escalated fires once. Less than expiresInMinutes.
customerMessageWhat the agent tells the person while it waits. Without it a neutral Spanish text is used.
automatedDecisionTrue when the action makes an automated decision about a person (Ley 21.719, art. 8 bis). It works with any mode. Every call leaves a record with the data it used and a reasonCode: an approval when a person decides, an automated decision (GET /v2/automated-decisions) when no one was asked or a rule rejected it. The person can ask for a human review of either.
Set the approval floor of a shared action
Only a platform, and only on an action shared with its subaccounts. The floor is the least approval any subaccount can run the action with: a call that meets it waits for the approvers you name here, whatever the policy of the subaccount says, and a subaccount cannot grant the action with mode never. The policy of the subaccount still applies on top, and the stricter one wins. Replaces the whole floor; mode never removes it. Idempotent.
Required scope: actions:write.
path Parameters
id^act_[0-9A-Za-z]{22}… · requiredThe id of the action (act_…).
Headers
Lelemon-Subaccount^sub_[0-9A-Za-z]{22}…The subaccount (sub_…) this request acts on. Only for the keys of a platform account; without it the request acts on the account itself.
Set the approval floor of a shared action › Request Body
modenever: the agent runs the action without approval. always: every call waits for a person. when: only the calls that meet condition, or that pass accumulated, wait. rules: the ordered list in rules decides each call; the first rule that applies wins.
Only for mode when. A comparison {param, op, value} with op eq, ne, gt, gte, lt, lte, in (value is a list) or exists (no value), or a group {all: [...]} or {any: [...]}. Up to 3 levels and 10 comparisons. If the argument is missing or has another type the call needs approval. param is a path into the arguments of the action, like amount or order.total.
Only for mode rules. Evaluated in order for every call: the first rule whose when applies decides, and the rest are not read. A rule without when applies to every call and has to be last. If no rule applies the call runs, so end with a rule that has no when to choose the default. Use it for a hard cap ("above X, reject"), or for steps by amount ("up to X a supervisor decides, above X the management"). A platform floor and accumulated still apply on top: a rule can never run an action the floor sends to a person.
Who may decide. Without it: owners and admins. A role includes the roles above it: admin also lets owners decide. An API key decides only if it is named here.
expiresInMinutesMinutes to decide. Past it the request expires, the action never runs and the agent tells the person.
escalateAfterMinutesMinutes after which a pending request escalates: approval.escalated fires once. Less than expiresInMinutes.
customerMessageWhat the agent tells the person while it waits. Without it a neutral Spanish text is used.
automatedDecisionTrue when the action makes an automated decision about a person (Ley 21.719, art. 8 bis). It works with any mode. Every call leaves a record with the data it used and a reasonCode: an approval when a person decides, an automated decision (GET /v2/automated-decisions) when no one was asked or a rule rejected it. The person can ask for a human review of either.
Set the approval floor of a shared action › Responses
modenever: the agent runs the action without approval. always: every call waits for a person. when: only the calls that meet condition, or that pass accumulated, wait. rules: the ordered list in rules decides each call; the first rule that applies wins.
Only for mode when. A comparison {param, op, value} with op eq, ne, gt, gte, lt, lte, in (value is a list) or exists (no value), or a group {all: [...]} or {any: [...]}. Up to 3 levels and 10 comparisons. If the argument is missing or has another type the call needs approval. param is a path into the arguments of the action, like amount or order.total.
Only for mode rules. Evaluated in order for every call: the first rule whose when applies decides, and the rest are not read. A rule without when applies to every call and has to be last. If no rule applies the call runs, so end with a rule that has no when to choose the default. Use it for a hard cap ("above X, reject"), or for steps by amount ("up to X a supervisor decides, above X the management"). A platform floor and accumulated still apply on top: a rule can never run an action the floor sends to a person.
Who may decide. Without it: owners and admins. A role includes the roles above it: admin also lets owners decide. An API key decides only if it is named here.
expiresInMinutesMinutes to decide. Past it the request expires, the action never runs and the agent tells the person.
escalateAfterMinutesMinutes after which a pending request escalates: approval.escalated fires once. Less than expiresInMinutes.
customerMessageWhat the agent tells the person while it waits. Without it a neutral Spanish text is used.
automatedDecisionTrue when the action makes an automated decision about a person (Ley 21.719, art. 8 bis). It works with any mode. Every call leaves a record with the data it used and a reasonCode: an approval when a person decides, an automated decision (GET /v2/automated-decisions) when no one was asked or a rule rejected it. The person can ask for a human review of either.